Replacing Siemens CPU 416-2 DP with CPU 414-3 PN/DP Safely

David Krause11 min read
S7-400SiemensTechnical Reference
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

Overview: Migration Scenario for SIMATIC S7-400

Replacing a SIMATIC S7-400 CPU 416-2 DP with a CPU 414-3 PN/DP is a common standardization move when maintenance teams consolidate spare-part inventories across plants. Both CPUs belong to the S7-400 family, execute the same STEP 7 instruction set, and share the same backplane and signal-module footprint, so the migration is mechanically trivial. The engineering risk lies entirely in resource deltas: the smaller CPU offers roughly half the work memory, half the bit memory, and half the addressable I/O area of the larger one. A project that compiles cleanly on a CPU 416-2 DP will not necessarily compile, link, or run on a CPU 414-3 PN/DP without explicit verification.

Siemens addresses this concern directly in the support entry "What should you watch out for when changing from one S7-400 CPU to another?" (Siemens ID 25208203). The article below operationalizes that guidance for the specific CPU 416-2 DP → CPU 414-3 PN/DP swap and adds the field-proven checks that catch the resource regressions before commissioning.

CPU Identification and Order Numbers

Before any migration, identify the exact MLFB (Siemens order number) of both units. The S7-400 catalog includes several firmware generations of each CPU; specifications and permissible OB set differ across them.

CPU Typical MLFB Firmware Role in Migration
CPU 414-3 PN/DP 6ES7414-3EM07-0AB0 V7.0 or later Target (replacement)
CPU 414-3 PN/DP 6ES7414-3EM06-0AB0 V6.0 Target (legacy)
CPU 416-2 DP 6ES7416-2XN05-0AB0 V5.x Source (existing)
CPU 416-2 DP 6ES7416-2XP05-0AB0 V5.x / V6.x Source (variant)
Note: Always confirm the exact order number on the front-panel label or in HW Config → Properties → Order Number. Mixing generations can change OB support and SFC/SFB availability.

Memory Capacity Comparison

The single largest constraint on a 416 → 414 swap is work memory. STEP 7 partitions user memory into code (loaded blocks plus their run-time data for code-only blocks) and data (DB contents, instance DBs). The CPU 414-3 PN/DP offers roughly half of each, which becomes binding as soon as the STEP 7 compiler reports "Memory area exceeded" warnings.

Parameter CPU 414-3 PN/DP (EM07) CPU 416-2 DP (XN05) Delta
Work memory, code 2 MB 2.8 MB -0.8 MB (~29 %)
Work memory, data 2 MB 2.8 MB -0.8 MB
Load memory (RAM + Flash) 4 MB integrated 8 MB integrated -4 MB
Bit memory (M) 8 KB 16 KB -8 KB
S7 timers (T) 512 1024 -512
S7 counters (C) 512 2048 -1536
Max DBs 2048 4096 -2048
Max FB / FC 2048 / 2048 4096 / 4096 halved

Calculate the consumed code/data sizes in advance:

  1. In SIMATIC Manager, right-click the S7 Program node → Object Properties → Blocks.
  2. Add the Required Work Memory of each block.
  3. Compare the totals against the Available column for the CPU 414-3 PN/DP.
  4. If totals exceed 70 % of available memory, plan a memory-optimization pass (DB packing, removing unused FBs/FCs, switching to multi-instance DBs).

I/O Address Area: The 8 KB vs. 16 KB Constraint

The CPU 416-2 DP supports a 16 KB input address area and a 16 KB output address area; the CPU 414-3 PN/DP supports only 8 KB of each. Address ranges in STEP 7 are mapped per rack / station / slot and aggregated across the entire station. The 8 KB boundary is therefore a hard limit that STEP 7 enforces during Save and Compile in HW Config.

How to Measure Current I/O Consumption

  1. Open HW Config for the CPU 416-2 DP project.
  2. For each slot/DP slave/IO device, expand the I addresses and Q addresses columns and record the highest byte used in the lowest and highest directions.
  3. Sum the input ranges (highest byte + 1) and the output ranges. The CPU 414-3 PN/DP will only accept totals ≤ 8192 bytes per direction.
  4. Repeat the check in LAD/FBD/STL Editor → Options → Address Overview to capture all symbolic I/O access points; this catches addresses generated by indirect PEB/PAB access.

If the CPU 416-2 DP station already consumes more than 8 KB in either direction, the swap is impossible without re-architecting the I/O layout (sub-DP segmentation, second station, or PN/IO line).

Process Image Configuration and Limits

The process image is the I/O and memory area the operating system refreshes automatically every OB1 cycle. It is a configurable subset of the full I/O address area. For the S7-400, the default process image for both CPUs is 512 bytes per direction, but the parameter is adjustable from 0 to 16 KB in HW Config → CPU → Properties → Cycle / Clock Memory.

Critical pitfall: If the project uses I/O addresses above the configured process-image size, those addresses are no longer refreshed automatically and must be read with L PIW / written with T PQW (or via SFCs 26/27). When migrating to the smaller CPU, lowering the process image size without auditing all I / Q accesses in the program is the most common source of "mystery" field-bus faults.

The CPU 414-3 PN/DP supports a process-image size up to 16 KB per direction — equal to the CPU 416-2 DP — so this parameter itself is not the binding constraint. However, the CPU Properties dialog differs slightly in presentation between firmware versions; always read the value the CPU reports after download (Online → CPU Information → Memory).

Bit Memory, Timers, and Counters

The CPU 414-3 PN/DP retains the same 8 KB bit-memory addressable range (MB 0 – MB 8191), but only 8 KB of that range is retained across power-cycle by default. If the CPU 416-2 DP project uses more than 8 KB of M-flags or relies on retain > 8 KB, configure retain in HW Config → CPU → Properties → Retentive Memory.

For timers and counters, the same principle applies:

  • Timers (T): CPU 414 supports 512, CPU 416 supports 1024. STEP 7 will refuse to load if the project references more.
  • Counters (C): CPU 414 supports 512, CPU 416 supports 2048. The IEC counters (SFB 0/1/2/3/4) bypass this limit and are recommended for new code.

OB Compatibility Matrix

Most OBs are supported identically. The deltas appear in OB 80/82/83/85 (error OBs) and OB 121/122 (programming-error OBs). Use the table below as a pre-checklist.

OB Function CPU 414-3 PN/DP CPU 416-2 DP
OB 1 Main cyclic Yes Yes
OB 10–17 Time-of-day Yes Yes
OB 20–23 Time-delay Yes Yes
OB 30–38 Cyclic interrupt Yes Yes
OB 40–47 Hardware interrupt Yes Yes
OB 55–57 DPR / DPV1 Yes Yes
OB 80 Time error Yes Yes
OB 82 Diagnostic interrupt Yes Yes
OB 83 Insert/remove Yes Yes
OB 85 Priority-class error Yes Yes
OB 100/101/102 Startup Yes Yes
OB 121/122 Programming error Yes Yes

Listing every OB used in the project is the only safe audit. In SIMATIC Manager use Options → Cross References → OB Selection.

Communication Interface Differences: DP vs. PN/DP

The CPU 416-2 DP exposes one combined MPI/DP port and one DP port. The CPU 414-3 PN/DP replaces the second DP port with a PROFINET port. This is the largest functional change in the migration and demands attention in three areas:

  1. Distributed I/O topology: PROFIBUS DP slaves attached to the second port of the CPU 416-2 DP must be re-homed — either to the remaining DP port (master reset) or migrated to PROFINET via a GSDML import. CPU 414-3 PN/DP can act as PROFINET IO Controller but not as PROFINET IO Device; existing PN-Device configurations must move upstream to an ET 200S/ET 200SP PN station.
  2. S7 communication: PG/OP routes on the MPI/DP port work identically. S7 connections via the DP port need to be recreated against the new PN interface.
  3. IP addressing: Configure the PN port with a fixed IP, subnet, and (if used) router in HW Config → PN Interface → Properties → Ethernet Parameters. PROFINET device names are case-sensitive and must match the topology editor.

STEP 7 Hardware Reconfiguration Procedure

Prerequisites

  • STEP 7 V5.5 + SPx (or TIA Portal V16+) installed with HW catalog ≥ firmware version of both CPUs.
  • Offline archive of the current CPU 416-2 DP project.
  • Engineering cable (MPI/USB or PN).

Procedure

  1. Open project containing the CPU 416-2 DP station.
  2. Replace CPU: right-click the CPU in HW Config → Replace Object → CPU → select CPU 414-3 PN/DP at the exact order number / firmware level you have on the shelf.
  3. Compile: Station → Save and Compile. STEP 7 emits warnings whenever a parameter drops below the original CPU's spec; treat every warning as a hard error until verified.
  4. Resolve I/O overflow: if compile fails on I/O address area, redistribute slaves across the remaining DP port or convert to PN/IO.
  5. Adjust retain: CPU Properties → Retentive Memory → set M / T / C ranges to match the original project (bounded by the CPU 414 limits).
  6. Adjust process image: keep the same Process Image Size value as the original project to preserve auto-refresh behaviour.
  7. Add PROFINET configuration if required: import GSDML, place IO-Devices, assign device names.
  8. Download: PLC → Download after powering down and physically swapping the CPU module.
  9. Cold restart: issue a Complete Restart (cold) via PLC → Operating Mode to initialize work memory and clear any diagnostic interrupts from the topology change.

Verification and Commissioning Steps

  1. Online → CPU Information → Memory: confirm code/data usage below the new CPU's max.
  2. Online → Accessible Nodes: verify PN and DP slaves come online with the expected diagnostic state.
  3. Variable Table / Watch Table: force I/O bytes at the extreme addresses (e.g., IB 8191 and QB 8191 on the CPU 414 side) to prove boundary access works.
  4. Run the application through one full OB 1 cycle and inspect OB 100 start-up info for unexpected restart events.
  5. Capture a Diagnostic Buffer dump before and after swap for the maintenance log.

Troubleshooting Matrix

Symptom Likely Cause Resolution
STEP 7 rejects download: "CPU does not support required work memory" Total code + data > 4 MB Optimize block sizes, remove unused FBs/FCs, consolidate DBs
DP slave goes to "Station failure" after CPU swap Master port assignment lost during CPU change Re-assign DP master system to interface X2 in HW Config
Inputs read stale data on first scan Process image size reduced Restore original process-image size in CPU Properties
Retain values lost on power cycle Retain range larger than 8 KB Reduce retain M/T/C to fit CPU 414 limits
S7 connection via second port fails Second port changed from DP to PN Re-establish connection using PN interface MAC/IP
OB 85 events logged at startup Unmapped I/O accessed by old code Audit I/Q access against new process-image size
CPU stays in STOP after download Startup OB or HW Config error Check diagnostic buffer, verify OB 100 present, check rack consistency

Standardization Notes for Spare-Pool Strategy

Standardizing on CPU 414-3 PN/DP as a universal spare is viable only for the subset of stations whose resource consumption fits within 8 KB I/O per direction, 8 KB M-flags, 4 MB work memory, and 512 timers / 512 counters. Larger or distributed-heavy stations must remain on the 416 class or move to CPU 417. A pragmatic field practice is to maintain a project metric sheet per station:

  • Highest input byte (decimal)
  • Highest output byte (decimal)
  • Total code memory (KB)
  • Total data memory (KB)
  • Retain M-range, T-range, C-range
  • Process image size (bytes)
  • Number and types of OBs used
  • Interface usage: DP master ports, PN devices

With this sheet, a controller swap becomes a paper exercise instead of a fire drill. Refer to Siemens Support entry 25208203 as the canonical checklist whenever a station is upgraded or downgraded across the S7-400 range.

Can I directly swap a CPU 416-2 DP with a CPU 414-3 PN/DP without changing the STEP 7 project?

No. The mechanical swap is straightforward, but the STEP 7 project must be re-compiled against the new CPU so that HW Config, retain ranges, and process image are resized to fit the CPU 414's 8 KB I/O area, 8 KB bit memory, and 4 MB total work memory. Otherwise download fails or the CPU enters STOP.

What is the maximum I/O address area of each CPU?

The CPU 414-3 PN/DP supports 8 KB of inputs and 8 KB of outputs (bytes 0–8191 per direction). The CPU 416-2 DP supports 16 KB per direction. STEP 7 enforces this limit during Save and Compile in HW Config.

How do I check the actual I/O and process-image usage of an existing CPU 416-2 DP project?

Open HW Config and read the highest I-address and Q-address per slot, then sum them. Open Options → Address Overview in the LAD/FBD/STL editor to capture all symbolic I/O accesses. Compare the totals against the CPU 414's 8 KB limit per direction and the configured Process Image Size in CPU Properties.

What happens if my project exceeds the 8 KB I/O limit on the CPU 414-3 PN/DP?

STEP 7 rejects Save and Compile. Re-architect the I/O topology: split the station into two, redistribute slaves across the remaining DP port, or convert DP slaves to PROFINET IO devices on the PN interface.

Do I need to update STEP 7 hardware configuration when changing CPU?

Yes. Right-click the CPU in HW Config and choose Replace Object → CPU, select the exact CPU 414-3 PN/DP order number and firmware, then Save and Compile. The tool resets interface parameters, retain areas, and process-image size to the new CPU's defaults, which must be re-tuned to match the original application.

Back to blog